Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

YouTube

The Art of Exploiting UAF by Ret2bpf in Android Kernel

Black Hat via YouTube

Start learning Write review
OpenLearning Ad

Master AI and Machine Learning: From Neural Networks to Applications

Learn More → Coursera Ad

AI, Data Science & Cloud Certificates from Google, IBM & Meta

Learn More →

Overview

Google, IBM & Meta Certificates – 40% Off
One Coursera Plus subscription covers most Professional Certificates on Coursera.
Unlock All Certificates
This course analyzes the Android xt_qtaguid kernel module and the exploitation of CVE-2021-0399, a long-standing use-after-free vulnerability. It covers heap manipulation, kernel information leaks, return-to-BPF privilege escalation, Android kernel mitigations, and behavioral detection.

Syllabus

Intro
xt_qtaguld - Introduction
xt_qtagulud Open Device
CVE-2017-13273
eventfd leaks kernel heap address
Step 1 - Double Free on kmalloc-128
KASLR Leak
Rooting (possible primitives)
Step 3 - Rooting (controlling seq_operations)
Step 3 - Rooting (overwriting addr_limit?)
Step 3 - Rooting (the ultimate ROP)
Step 3 - Rooting (root shell)
Summarization for Exploiting CVE-2021-0399
CONFIG_SLAB_FREELIST HARDENED
KFENCE
Kernel Control Flow Integrity
CONFIG_DEBUG_LIST
On-Device Protection
Backend Infrastructure
Behavioural Detection
Summary

Taught by

Black Hat

Reviews

Start your review of The Art of Exploiting UAF by Ret2bpf in Android Kernel

Start learning

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Sign up for free
Someone learning on their laptop while sitting on the floor.